Implementing and Reasoning About Hash-consed Data Structures in Coq

Abstract

We report on four different approaches to implementing hash-consing in Coq programs. The use cases include execution inside Coq, or execution of the extracted OCaml code. We explore the different trade-offs between faithful use of pristine extracted code, and code that is fine-tuned to make use of OCaml programming constructs not available in Coq. We discuss the possible consequences in terms of performances and guarantees. We use the running example of binary decision diagrams and then demonstrate the generality of our solutions by applying them to other examples of hash-consed data structures.

A Formally-Verified C Static Analyzer

“…In Verasco, we already obtained good speedups by preserving preexisting sharing between the arguments of join operations. Going further, we could re-share a posteriori using general hash-consing [10].…”

Sealing pointer-based optimizations behind pure functions

“…We note that in contrast to the problems we have considered in this paper, existing pure languages can construct ROBDDs from scratch and manipulate them without exponential blowup, e.g. by either of the two pure approaches used by [Braibant et al 2014] to implement them in Gallina. The important distinction is that in existing pure languages, one can easily build ROBDDs from the bottom up using an explicit graph representation, whereas if you start with a term whose tree size is astronomically large, there is nothing you can do without the ability to compare memory addresses of subterms.…”

“…This process is ad-hoc and unsafe in general, as the system itself cannot discern pure extraction instructions from impure ones. For example, Braibant et al [2014] implement a naive BDD type in Gallina, extract it to an OCaml type that stores a unique identifier, extract the Gallina constructors to OCaml łsmartž constructors that make use of a hash-consing library to guarantee maximal sharing, and extract the structural equality test on their BDD type to OCaml's physical (i.e. pointer) equality test.…”

“…One of the main motivations of the present work is that there is no way to traverse this term in sub-exponential time using existing pure functional languages. There are ways to construct other kinds of entities from the bottom up that are isomorphic to this term in the presence of some additional state and that can be traversed efficiently, for example by either of the first two approaches described in [Braibant et al 2014]. However, in existing pure languages, there is no way to efficiently traverse a term of a standard inductive type like the one above.…”

Simple, light, yet formally verified, global common subexpression elimination and loop-invariant code motion

“…To overcome both, we use an approach similar to the "smart constructor" approach advocated by Braibant et al [2014] for implementing verified reduced ordered binary decision diagrams in Coq.…”